IAM 8.4 - Changelog

IAM now supports a new YAML configuration format (in addition to the XML configuration). To enable the YAML format use the application parameter (instance.properties) iam.config.format.

See Using YAML.

New CLI commands to connect plugins to plugin properties, plugin list properties, and plugin map properties in YAML configuration files. See usage message of iam config connect command.

See also Configuration CLIs.

New CLI to convert XML configuration files to the new YAML format. For details, see usage of iam config convert command.

See also Configuration CLIs.

Airlock 2FA activation code for manual device activation without QR code in Adminapp.

The Admin REST API endpoint /users/userId/tokens/airlock-2fa/activation-letters now also returns the 16-digit activation code and the code may be displayed in the Airlock 2FA device management in Adminapp's user management.

Access to the activation code is protected by then new Adminapp access control action View Airlock 2FA Activation Secrets.

See also Token management (Airlock 2FA) and Token enrollment.

During FIDO/Passkey passkey registration in the Loginapp, the FIDO key's display name can be auto-generated based on the AAGUID of the FIDO key. It can be edited in a subsequent step.

Existing configurations are migrated to preserve the behavior.

See also Use case: FIDO passkey registration self-service and Use case: FIDO token migration self-service.

The new context retention feature allows specifying a policy determining whether to hold on to a configuration context for a request or a session in the Loginapp. It also supports calls on /ui/app/ URLs.

See Configuration and usage.

OATH OTP enrollment QR codes can now displayed to the user in auth flows, self-registration flows, and protected self-service flows. This allows the user to self-enroll OATH OTP tokens.

See OATH OTP authentication.

Responses for failed CAPTCHA checks are no longer delayed.

The condition Has Suitable Airlock 2FA Device now has a configurable flag to respect cooldown information.

Fixed propagation of authentication timestamp in one-shot authentication.

Fixed a bug in the Airlock 2FA Usernameless Authentication Step plugin: QR codes are now valid for the period configured (was always restricted to 30 seconds regardless of the configuration).

The Set Context Data Step in the authentication flow did not emit a Context Data Event. This has been fixed and an event is now emitted.

All steps can now provide custom additional attributes. See Additional and custom attributes in REST responses.

Configurable goto targets for failing step results. Depending on the failure type, the flow can be continued at a different position instead of aborting the flow.

See On-failure Goto (flow concept).

Unexpected requests to flow REST endpoints (error code UNEXPECTED_CALL) no longer terminate the flow and return a 400 status code instead of 403.

OAuth2 Token Exchange Delegation: IAM now supports actor tokens of type urn:ietf:params:oauth:token-type:jwt to be used in delegation use cases.

See Token Exchange service overview and Token Exchange Configuration.

In the OAuth/OIDC authorization server, a new property Cache-Control Response Header allows setting the Cache-Control response HTTP header to the specified value for the following endpoints:

The same setting has been added to the Loginapp >> JWKS Settings. It allows setting the Cache-Control response HTTP header for the endpoint /auth-login/rest/public/jwks/.

See Dynamic client registration configuration and JWKS endpoint.

OAuth/OIDC performance improvement:

If a Grace Period is configured in OAuth 2.0 Authorization Code Grant or OpenID Connect Authorization / Hybrid Code Flow, refresh tokens that have been refreshed at least once are now reduced in validity to the grace period end. Therefore they can be cleaned up much earlier if their lifetime would otherwise be very long.

To proactively clean up such tokens, the following query (as an example for Oracle) can be used (for other databases, the logic to calculate the current millis since epoch needs to be adapted accordingly):

DELETE FROM TOKEN WHERE
  TYPE='OAUTH2'
  AND GENERIC_DATA_ELEMENT_1='refresh_token'
  AND GENERIC_DATA_ELEMENT_11 IS NOT NULL
  AND TO_NUMBER(GENERIC_DATA_ELEMENT_11) < (CAST(SYSTIMESTAMP AT TIME ZONE 'UTC' AS DATE) - TO_DATE('1970-01-01', 'YYYY-MM-DD')) * 86400 * 1000 

The Loginapp UI now also supports OAuth 2.0/OIDC redirect URIs using a private-use scheme (containing only one slash after the colon, e.g., com.example.app:/oauth).

The JWT access tokens issued by the OAuth 2.0 Client Credentials Grant now always contain a random jti claim.

The Cronto activation cryptogram may now be displayed in the Adminapp user management and is available in the Admin REST API. Access to it is limited to roles with the new access control action View Cronto Activation Secret.

See Cronto Token Controller configuration.

The plugin ID is now displayed and editable in the Config Editor.

Note that the former plugin Identifier - the descriptive name of the plugin - is now called Display Name. The ID refers to the technical identifier: it is a UUID in the XML configuration but can be an arbitrary ID in the new YAML format (see Using YAML).

The Adminapp no longer runs into an idle timeout while working in the Config Editor. The Config Editor no longer shows a red banner notifying about a session timeout, but directly redirects to the login page.

Fixed entry path in gateway mapping template for new Adminapp REST endpoint mappings.

Redis connection plugins now support the Redis Sentinel mode (for high-availability).

See Storing session state in an external Redis session repository.

The usage analytics feature allows Airlock to collect license and usage analytics data to improve and optimize future product development.

It is enabled and configured in Adminapp >> License and Usage Analytics

Failing to connect to external systems (Futurae service, SMS gateway, email server, RADIUS) from flow steps leads to an error step result that can now be handled using the On Failure Gotos flow step feature to continue the flow.

See On-failure Goto (flow concept).

In the LDAP Connection Pool plugin, the key store and trust store can now be configured separately.

The Airlock Gateway mapping templates for IAM now make use of the new Gateway 8.3 features Server-Side Request Forgery deny rule group and enable Overload Prevention.

Note the new mapping templates for Gateway 8.3 and newer in Configuration of IAM mappings.

The Airlock Gateway mapping templates for IAM have been improved: Request Rewrite > Host header translate is now set to INHERIT (was DISABLED).

Fixed Use STARTTLS behavior in the SMTP Email Service plugin.

Fixes a bug in the XML File Importer Task: avoid NullPointerException when processing empty commands.

Updated Airlock IAM—Microgateway Helm Chart: We have added support for Microgateway 4.5. The chart released with IAM 8.4 is now compatible with Airlock Microgateway versions from 4.3 to 4.5.

Use the parameter .Values.global.microgatewayVersion to enable compatibility for the respective version of Airlock Microgateway.

Fixed a bug where the predefined Deny Rule Exceptions were too permissive for HTTP Methods.